CISM practice questions 321–330

1. Question 321 · 1243 in bank

   An information security manager has determined that the mean time to prioritize information security incidents has increased to an unacceptable level. Which of the following processes would BEST enable the information security manager to address this concern?

   • AIncident classification
   • BIncident response
   • CForensic analysis
   • DVulnerability assessment

   Show answer

   Answer: A

   Explanation

   Triage step happens before the Response step in an incident management plan. Categorization is the process using predetermined criteria to classify all incoming reports/events, then responding to them. So A would take place before B.

   Source: Adapted from community discussion — pizzab0i

   Next question

2. Question 322 · 1243 in bank

   An information security manager discovers that newly hired privileged users are not taking necessary steps to protect critical information at their workstations. Which of the following is the BEST way to address this situation?

   • APublish an acceptable use policy and require signed acknowledgment.
   • BTurn on logging and record user activity.
   • CCommunicate the responsibility and provide appropriate training.
   • DImplement a data loss prevention (DLP) solution.

   Show answer

   Answer: C

   Next question

3. Question 323 · 1243 in bank

   Which of the following should be the MOST important consideration when prioritizing risk remediation?

   • AEvaluation of risk
   • BDuration of exposure
   • CComparison to risk appetite
   • DImpact of compliance

   Show answer

   Answer: C

   Explanation

   Comparison to risk appetite refers to assessing the identified risks in relation to the organization's tolerance for risk. Risk appetite defines the level of risk that an organization is willing to accept in pursuit of its objectives. It takes into account factors such as strategic goals, operational requirements, legal and regulatory obligations, and the organization's overall risk culture. When prioritizing risk remediation efforts, it is crucial to align them with the organization's risk appetite. By comparing identified risks to the risk appetite, organizations can determine the level of priority for remediation. This ensures that resources are allocated effectively and that risks are addressed in a manner consistent with the organization's risk tolerance and strategic objectives. While the other options may also have relevance in the risk prioritization process, they are not as fundamental as aligning with risk appetite:

   Source: Adapted from community discussion — mad68

   Next question

4. Question 324 · 1243 in bank

   To set security expectations across the enterprise, it is MOST important for the information security policy to be regularly reviewed and endorsed by:

   • Asecurity administrators.
   • Bsenior management.
   • Cthe chief information security officer (CISO).
   • Dthe IT steering committee.

   Show answer

   Answer: B

   Explanation

   Summary of responsibilities as it concerns policies: - CISO is responsible for overseeing the creation of policies - InfoSec Governance is responsible for creating policies - Senior Management is responsible for reviewing and endorsing. - IT Steering Committee is responsible for approving policies. - Security Administrators implement and enforce the policies

   Source: Adapted from community discussion — dark_3k03r

   Next question

5. Question 325 · 1243 in bank

   Senior management wants to provide mobile devices to its sales force. Which of the following should the information security manager do FIRST to support this objective?

   • ADevelop an acceptable use policy
   • BConduct a vulnerability assessment on the devices
   • CAssess risks introduced by the technology
   • DResearch mobile device management (MDM) solutions

   Show answer

   Answer: C

   Explanation

   C. Assess risks introduced by the technology Before implementing any new technology, it is important to assess the risks it may introduce to the organization. This includes identifying and evaluating potential security risks, as well as assessing the impact of those risks on the organization's operations and assets. Once the risks have been identified, the information security manager can develop an appropriate risk mitigation strategy and determine if the benefits of implementing the technology outweigh the risks. By assessing risks first, the information security manager can help ensure that the organization's objectives are met in a secure and controlled manner.

   Source: Adapted from community discussion — Broesweelies

   Next question

6. Question 326 · 1243 in bank

   Threat and vulnerability assessments are important PRIMARILY because they are:

   • Aused to establish security investments.
   • Bneeded to estimate risk.
   • Cthe basis for setting control objectives.
   • Delements of the organization's security posture.

   Show answer

   Answer: B

   Explanation

   Threat and vulnerability assessments provide essential information to estimate and understand the level of risk facing an organization. By identifying potential threats and vulnerabilities, organizations can assess the likelihood and potential impact of various security incidents. This risk estimation forms the basis for making informed decisions about security controls, investments, and setting control objectives. While threat and vulnerability assessments contribute to elements of the organization's security posture (option D) and may influence control objectives (option C), the primary purpose is to assess and estimate the level of risk.

   Source: Adapted from community discussion — Viperhunter

   Next question

7. Question 327 · 1243 in bank

   An information security manager needs to ensure security testing is conducted on a new system. Which of the following would provide the HIGHEST level of assurance?

   • AThe vendor provides the results of a penetration test and code review.
   • BAn independent party is directly engaged to conduct testing.
   • CThe internal audit team is enlisted to run a vulnerability assessment against the system.
   • DThe security team conducts a self-assessment against a recognized industry framework.

   Show answer

   Answer: B

   Next question

8. Question 328 · 1243 in bank

   An organization performed a risk analysis and found a large number of assets with low-impact vulnerabilities. The NEXT action of the information security manager should be to:

   • Atransfer the risk to a third party.
   • Bdetermine appropriate countermeasures.
   • Creport to management.
   • Dquantify the aggregated risk.

   Show answer

   Answer: D

   Explanation

   D . quantify the aggregated risk. When an organization identifies a large number of assets with low-impact vulnerabilities, the next step for the information security manager should be to quantify the aggregated risk. This involves analyzing the collective impact of these low-impact vulnerabilities on the organization's overall security posture. While individually these vulnerabilities may seem minor, their cumulative effect could pose a significant risk to the organization's operations, confidentiality, integrity, or availability of data. Quantifying the aggregated risk enables the information security manager to: Understand the broader implications of multiple low-impact vulnerabilities. Make informed decisions about prioritizing remediation efforts based on the collective risk. Allocate resources efficiently to address vulnerabilities that, when combined, could have a substantial impact.

   Source: Adapted from community discussion — helg420

   Next question

9. Question 329 · 1243 in bank

   Organization A offers e-commerce services and uses secure transport protocol to protect Internet communication. To confirm communication with Organization A, which of the following would be the BEST for a client to verify?

   • AThe URL of the e-commerce server
   • BThe certificate of the e-commerce server
   • CThe IP address of the e-commerce server
   • DThe browser's indication of SSL use

   Show answer

   Answer: B

   Next question

10. Question 330 · 1243 in bank

    Which of the following provides the MOST useful information for identifying security control gaps on an application server?

    • ARisk assessments
    • BPenetration testing
    • CThreat models
    • DInternal audit reports

    Show answer

    Answer: B

    Explanation

    Out of the given options, the MOST useful information for identifying security control gaps on an application server would be Penetration testing. Penetration testing involves actively testing a system or application to identify vulnerabilities that an attacker could exploit. It provides a real-world assessment of the security posture of an application server and can help identify security control gaps that may not have been identified through other means. Risk assessments, threat models, and internal audit reports can also be useful in identifying security control gaps, but they tend to be more focused on identifying risks and compliance issues rather than actively testing the system to find vulnerabilities. Therefore, while they can be valuable tools in a comprehensive security assessment, they may not provide the same level of insight into security control gaps as penetration testing. B is the answer

    Source: Adapted from community discussion — bambs

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 321. 1243 questions available.